@apifuse/provider-sdk 2.2.0-beta.11 → 2.2.0-beta.13

package/dist/runtime/http.js

@@ -2,7 +2,7 @@ import { policyRotatesTransportVendorChain, resolvePolicyTransportAttemptCap, re
 import { ProviderError, TransportError } from "../errors.js";
 import { parseSseStream, readableBytes, readableLines, readableTextChunks } from "../stream.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, isProxyTransportRetryMethod, normalizeProxyTransportRetryOptions, proxyTransportRetryErrorCode, proxyTransportRetryErrorStatus, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
-import { appendQueryParams, normalizeHttpRequestBody } from "./request-options.js";
+import { normalizeHttpRequestBody, redactSensitiveError, redactSensitiveRequestError, serializeRequestUrl, } from "./request-options.js";
 const DEFAULT_HTTP_BASE_URL = "http://localhost";
 function isHttpStatusOutcome(outcome) {
     return "kind" in outcome && outcome.kind === "http-status";
@@ -124,9 +124,38 @@ function requireNativeResponseBody(response) {
     }
     return response.body;
 }
-function toNativeHttpStreamResponse(response) {
+function sanitizeStreamErrors(body, serializedUrl) {
+    if (serializedUrl.sensitiveValues.length === 0)
+        return body;
+    let reader;
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                reader ??= body.getReader();
+                const chunk = await reader.read();
+                if (chunk.done) {
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(chunk.value);
+            }
+            catch (error) {
+                controller.error(redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl));
+            }
+        },
+        async cancel(reason) {
+            try {
+                await (reader ? reader.cancel(reason) : body.cancel(reason));
+            }
+            catch (error) {
+                throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
+            }
+        },
+    }, { highWaterMark: 0 });
+}
+function toNativeHttpStreamResponse(response, serializedUrl) {
     const headers = Object.fromEntries(response.headers.entries());
-    const body = requireNativeResponseBody(response);
+    const body = sanitizeStreamErrors(requireNativeResponseBody(response), serializedUrl);
     return {
         body,
         headers,
@@ -202,8 +231,17 @@ function normalizeNativeFetchBody(body) {
     copied.set(normalized);
     return copied.buffer;
 }
+function serializeHttpRequestUrl(baseUrl, url, options) {
+    try {
+        return serializeRequestUrl(resolveHttpUrl(baseUrl, url), options.params, options.sensitiveParams);
+    }
+    catch (error) {
+        throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+    }
+}
 async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, warn, statusRetryCodes, proxyAttemptOffset = 0, dedupe) {
-    const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+    const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+    const { requestUrl } = serializedUrl;
     const controller = options.timeout ? new AbortController() : undefined;
     const timeoutHandle = options.timeout
         ? setTimeout(() => controller?.abort(), options.timeout)
@@ -258,9 +296,9 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
     }
     catch (error) {
         if (error instanceof SyntaxError) {
-            throw error;
+            throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         }
-        const transportError = toHttpTransportError(error);
+        const transportError = redactSensitiveError(toHttpTransportError(error), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         transportError.proxyUsed = Boolean(proxy);
         throw transportError;
     }
@@ -270,7 +308,8 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
     }
 }
 async function fetchNativeHttpStream(baseUrl, url, method, options, clientOptions, warn) {
-    const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+    const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+    const { requestUrl } = serializedUrl;
     const controller = options.timeout ? new AbortController() : undefined;
     const timeoutHandle = options.timeout
         ? setTimeout(() => controller?.abort(), options.timeout)
@@ -296,13 +335,13 @@ async function fetchNativeHttpStream(baseUrl, url, method, options, clientOption
                 status: response.status,
             });
         }
-        return toNativeHttpStreamResponse(response);
+        return toNativeHttpStreamResponse(response, serializedUrl);
     }
     catch (error) {
         if (error instanceof SyntaxError) {
-            throw error;
+            throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         }
-        throw toHttpTransportError(error);
+        throw redactSensitiveError(toHttpTransportError(error), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
     }
     finally {
         if (timeoutHandle)
@@ -320,19 +359,27 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
         warn(message);
     };
     async function request(url, method, options = {}) {
-        if (!baseUrl && !isAbsoluteUrl(url)) {
-            throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
-        }
-        assertNoHttpTransportOverrides(options);
-        const headersOptions = withClientHeaders(options, clientOptions, options.body);
-        const methodName = normalizeHttpMethod(method);
-        const explicitRetry = headersOptions.retry !== undefined;
-        const retryOptions = normalizeProxyTransportRetryOptions(headersOptions.retry, {
-            label: "HTTP",
-        }) ??
-            (explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
-        if (retryOptions)
-            validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+        const { explicitRetry, headersOptions, methodName, retryOptions } = (() => {
+            try {
+                if (!baseUrl && !isAbsoluteUrl(url)) {
+                    throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
+                }
+                assertNoHttpTransportOverrides(options);
+                const headersOptions = withClientHeaders(options, clientOptions, options.body);
+                const methodName = normalizeHttpMethod(method);
+                const explicitRetry = headersOptions.retry !== undefined;
+                const retryOptions = normalizeProxyTransportRetryOptions(headersOptions.retry, {
+                    label: "HTTP",
+                }) ??
+                    (explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
+                if (retryOptions)
+                    validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+                return { explicitRetry, headersOptions, methodName, retryOptions };
+            }
+            catch (error) {
+                throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+            }
+        })();
         const retryEnabled = Boolean(retryOptions &&
             retryOptions.attempts > 1 &&
             isProxyTransportRetryMethod(methodName, retryOptions));
@@ -391,9 +438,7 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
             explicitRetry,
             method: methodName,
         });
-        const dedupeContext = dedupeAllocatorEndpoints
-            ? { attempted: new Set() }
-            : undefined;
+        const dedupeContext = dedupeAllocatorEndpoints ? { attempted: new Set() } : undefined;
         const executeOnce = (proxyAttemptOffset = 0) => fetchNativeHttp(baseUrl, url, methodName, attemptOptions, clientOptions, warnOnce, statusRetryEnabled ? retryOptions?.statusCodes : undefined, proxyAttemptOffset, dedupeContext);
         if (!retryEnabled || !retryOptions) {
             const outcome = await executeOnce();
@@ -492,12 +537,21 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
         });
     }
     async function streamRequest(url, method, options = {}) {
-        if (!baseUrl && !isAbsoluteUrl(url)) {
-            throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
-        }
-        assertNoHttpTransportOverrides(options);
-        const headersOptions = withClientHeaders(options, clientOptions, options.body);
-        const methodName = normalizeHttpMethod(method);
+        const { headersOptions, methodName } = (() => {
+            try {
+                if (!baseUrl && !isAbsoluteUrl(url)) {
+                    throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
+                }
+                assertNoHttpTransportOverrides(options);
+                return {
+                    headersOptions: withClientHeaders(options, clientOptions, options.body),
+                    methodName: normalizeHttpMethod(method),
+                };
+            }
+            catch (error) {
+                throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+            }
+        })();
         return fetchNativeHttpStream(baseUrl, url, methodName, headersOptions, clientOptions, warnOnce);
     }
     return {

package/dist/runtime/instrumentation.js

@@ -1,5 +1,8 @@
+import { readableBytes, readableLines, readableTextChunks } from "../stream.js";
+import { parseHttpRequestInvocation, isSensitiveKey, redactSensitiveError, redactSensitiveText, redactUrlQueryParams, requestOptionsFromHttpInvocation, serializeRequestUrl, } from "./request-options.js";
 import { createTraceContext, getTraceRecorder, } from "./trace.js";
 const BROWSER_PAGE_METHODS = new Set(["goto", "fill", "click", "type", "waitForSelector"]);
+const DIAGNOSTIC_BASE_URL = "http://apifuse-instrumentation.invalid";
 function isThenable(value) {
     return ((typeof value === "object" || typeof value === "function") &&
         value !== null &&
@@ -51,8 +54,173 @@ function getUrl(namespace, args, result) {
     }
     return undefined;
 }
+function requestOptionsForInvocation(namespace, methodName, args) {
+    if (namespace === "http") {
+        const invocation = parseHttpRequestInvocation(methodName, [...args]);
+        return invocation ? requestOptionsFromHttpInvocation(invocation) : undefined;
+    }
+    if (namespace !== "stealth" || methodName !== "fetch" || typeof args[0] !== "string") {
+        return undefined;
+    }
+    const options = args[1];
+    return options !== null && typeof options === "object" && !Array.isArray(options)
+        ? options
+        : undefined;
+}
+function fallbackSensitiveValues(options) {
+    const sensitiveParams = options?.sensitiveParams;
+    if (!sensitiveParams || typeof sensitiveParams !== "object")
+        return [];
+    return Object.values(sensitiveParams).map(String);
+}
+function stripDiagnosticBase(url) {
+    return url.startsWith(DIAGNOSTIC_BASE_URL) ? url.slice(DIAGNOSTIC_BASE_URL.length) || "/" : url;
+}
+function serializeDiagnosticUrl(url, options) {
+    try {
+        return {
+            degraded: false,
+            serializedUrl: serializeRequestUrl(url, options?.params, options?.sensitiveParams),
+        };
+    }
+    catch {
+        try {
+            const absoluteUrl = new URL(url, DIAGNOSTIC_BASE_URL).toString();
+            const serialized = serializeRequestUrl(absoluteUrl, options?.params, options?.sensitiveParams);
+            return {
+                degraded: false,
+                serializedUrl: {
+                    requestUrl: stripDiagnosticBase(serialized.requestUrl),
+                    redactedUrl: stripDiagnosticBase(serialized.redactedUrl),
+                    sensitiveValues: serialized.sensitiveValues,
+                },
+            };
+        }
+        catch {
+            const sensitiveParamNames = Object.keys(options?.sensitiveParams ?? {});
+            const structural = redactUrlQueryParams(url, sensitiveParamNames);
+            return {
+                degraded: true,
+                serializedUrl: {
+                    requestUrl: url,
+                    redactedUrl: structural.redactedUrl,
+                    sensitiveValues: [
+                        ...new Set([...fallbackSensitiveValues(options), ...structural.sensitiveValues]),
+                    ],
+                },
+            };
+        }
+    }
+}
+function snapshotRequestDiagnostics(namespace, methodName, args) {
+    const options = requestOptionsForInvocation(namespace, methodName, args);
+    const url = typeof args[0] === "string" ? args[0] : undefined;
+    const hasSensitiveParams = Boolean(options?.sensitiveParams && Object.keys(options.sensitiveParams).length > 0);
+    const sensitiveParamNames = Object.keys(options?.sensitiveParams ?? {});
+    const diagnosticUrl = hasSensitiveParams && url ? serializeDiagnosticUrl(url, options) : undefined;
+    const traceUrl = hasSensitiveParams && url
+        ? serializeDiagnosticUrl(url, { sensitiveParams: options?.sensitiveParams }).serializedUrl
+            .redactedUrl
+        : undefined;
+    return {
+        ...(diagnosticUrl?.degraded ? { diagnosticUrlDegraded: true } : {}),
+        ...(hasSensitiveParams ? { requestId: crypto.randomUUID() } : {}),
+        serializedUrl: diagnosticUrl?.serializedUrl,
+        sensitiveParamNames,
+        sensitiveValues: diagnosticUrl?.serializedUrl.sensitiveValues ?? fallbackSensitiveValues(options),
+        traceUrl,
+    };
+}
+function sanitizeRequestError(error, diagnostics) {
+    return redactSensitiveError(error, diagnostics.sensitiveValues, diagnostics.serializedUrl?.requestUrl, diagnostics.serializedUrl?.redactedUrl);
+}
+function isHttpStreamResponse(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "body" in value &&
+        value.body instanceof ReadableStream);
+}
+function instrumentHttpStreamConsumption(value, recorder, args, diagnostics) {
+    const source = value.body;
+    let reader;
+    const body = new ReadableStream({
+        async pull(controller) {
+            try {
+                reader ??= source.getReader();
+                const chunk = await reader.read();
+                if (chunk.done) {
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(chunk.value);
+            }
+            catch (error) {
+                const sanitizedError = sanitizeRequestError(error, diagnostics);
+                try {
+                    await recorder.runSpan("http.stream.consume", () => {
+                        throw sanitizedError;
+                    }, {
+                        onError: (spanError) => buildSpanAttributes("http", "stream", args, undefined, spanError, diagnostics),
+                    });
+                }
+                catch (recordedError) {
+                    controller.error(recordedError);
+                }
+            }
+        },
+        async cancel(reason) {
+            try {
+                await (reader ? reader.cancel(reason) : source.cancel(reason));
+            }
+            catch (error) {
+                throw sanitizeRequestError(error, diagnostics);
+            }
+        },
+    }, { highWaterMark: 0 });
+    const instrumented = {
+        ...value,
+        body,
+        bytes: () => readableBytes(body),
+        textChunks: () => readableTextChunks(body),
+        lines: () => readableLines(body),
+    };
+    try {
+        Object.assign(value, instrumented);
+        return value;
+    }
+    catch {
+        return instrumented;
+    }
+}
+function isAsyncIterable(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        Symbol.asyncIterator in value &&
+        typeof value[Symbol.asyncIterator] === "function");
+}
+function instrumentHttpSseConsumption(value, recorder, args, diagnostics) {
+    const source = value;
+    return {
+        async *[Symbol.asyncIterator]() {
+            try {
+                for await (const event of source)
+                    yield event;
+            }
+            catch (error) {
+                const sanitizedError = sanitizeRequestError(error, diagnostics);
+                return await recorder.runSpan("http.sse.consume", () => {
+                    throw sanitizedError;
+                }, {
+                    onError: (spanError) => buildSpanAttributes("http", "sse", args, undefined, spanError, diagnostics),
+                });
+            }
+        },
+    };
+}
 function getMethod(namespace, methodName, args) {
     if (namespace === "http") {
+        // Preserve the original instrumentation contract: generic entry points are
+        // reported as REQUEST/STREAM/SSE, independent of transport options.
         return methodName.toUpperCase();
     }
     if (namespace === "stealth") {
@@ -64,15 +232,23 @@ function getMethod(namespace, methodName, args) {
     }
     return undefined;
 }
-function buildSpanAttributes(namespace, methodName, args, result, error) {
+function buildSpanAttributes(namespace, methodName, args, result, error, diagnostics = { sensitiveParamNames: [], sensitiveValues: [] }) {
     const attributes = {};
-    const url = getUrl(namespace, args, result);
+    const rawUrl = getUrl(namespace, args, result);
+    const structuralUrl = diagnostics.traceUrl ?? rawUrl;
+    const url = structuralUrl
+        ? redactSensitiveText(structuralUrl, diagnostics.sensitiveValues, diagnostics.serializedUrl?.requestUrl, diagnostics.serializedUrl?.redactedUrl)
+        : undefined;
     const method = getMethod(namespace, methodName, args);
     const status = error ? getErrorStatus(error) : getResponseStatus(namespace, result);
     const duration = error ? undefined : getResponseDuration(result);
     if (url) {
         attributes.url = url;
     }
+    if (diagnostics.requestId)
+        attributes.request_id = diagnostics.requestId;
+    if (diagnostics.diagnosticUrlDegraded)
+        attributes.redaction_degraded = true;
     if (method) {
         attributes.method = method;
     }
@@ -91,6 +267,51 @@ function buildSpanAttributes(namespace, methodName, args, result, error) {
     }
     return attributes;
 }
+function isStealthRedirectRunResult(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "reason" in value &&
+        typeof value.reason === "string" &&
+        "hops" in value &&
+        Array.isArray(value.hops) &&
+        "final" in value &&
+        typeof value.final === "object" &&
+        value.final !== null);
+}
+function buildStealthRedirectAttributes(args, result, error, diagnostics) {
+    const attributes = buildSpanAttributes("stealth", "fetch", args, undefined, error, diagnostics);
+    if (!isStealthRedirectRunResult(result))
+        return attributes;
+    attributes.redirect_reason = result.reason;
+    attributes.redirect_hop_count = result.hops.length;
+    attributes.status = result.final.status;
+    if (result.hops.length > 0) {
+        const sensitiveValues = new Set(diagnostics.sensitiveValues);
+        const path = result.hops
+            .map((hop) => {
+            const hopUrl = hop.nextUrl ?? hop.url;
+            const responseSensitiveParamNames = [...queryParamNames(hopUrl)].filter(isSensitiveKey);
+            const structural = redactUrlQueryParams(hopUrl, [
+                ...new Set([...diagnostics.sensitiveParamNames, ...responseSensitiveParamNames]),
+            ]);
+            for (const value of structural.sensitiveValues)
+                sensitiveValues.add(value);
+            const safeUrl = redactSensitiveText(structural.redactedUrl, [...sensitiveValues]);
+            return `${hop.method} ${hop.status} ${safeUrl}`;
+        })
+            .join(" -> ");
+        attributes.redirect_path = redactSensitiveText(path, [...sensitiveValues], diagnostics.serializedUrl?.requestUrl, diagnostics.serializedUrl?.redactedUrl);
+    }
+    return attributes;
+}
+function queryParamNames(url) {
+    const queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return new Set();
+    const fragmentStart = url.indexOf("#", queryStart);
+    const query = url.slice(queryStart + 1, fragmentStart === -1 ? undefined : fragmentStart);
+    return new Set(new URLSearchParams(query).keys());
+}
 function getBrowserPageAttributes(methodName, args, elapsedMs, error) {
     const attributes = {};
     if (methodName === "goto") {
@@ -151,7 +372,49 @@ function wrapPage(page, trace) {
         },
     });
 }
-function wrapNamespace(namespace, target, trace) {
+function wrapStealthRedirects(redirects, trace) {
+    const recorder = getTraceRecorder(trace);
+    if (!recorder)
+        return redirects;
+    return {
+        run(...args) {
+            const diagnosticArgs = [args[0].url, args[0]];
+            const diagnostics = snapshotRequestDiagnostics("stealth", "fetch", diagnosticArgs);
+            let result;
+            try {
+                result = redirects.run(...args);
+            }
+            catch (error) {
+                const sanitizedError = sanitizeRequestError(error, diagnostics);
+                recorder
+                    .runSpan("stealth.redirects.run", () => {
+                    throw sanitizedError;
+                }, {
+                    onError: (spanError) => buildStealthRedirectAttributes(diagnosticArgs, undefined, spanError, diagnostics),
+                })
+                    .catch(() => undefined);
+                throw sanitizedError;
+            }
+            const sanitizedResult = Promise.resolve(result).catch((error) => {
+                throw sanitizeRequestError(error, diagnostics);
+            });
+            return recorder.runSpan("stealth.redirects.run", () => sanitizedResult, {
+                onSuccess: (spanResult) => buildStealthRedirectAttributes(diagnosticArgs, spanResult, undefined, diagnostics),
+                onError: (error) => buildStealthRedirectAttributes(diagnosticArgs, undefined, error, diagnostics),
+            });
+        },
+    };
+}
+function wrapStealthSession(session, trace) {
+    const wrappedSession = wrapNamespace("stealth", session, trace);
+    const redirects = wrapStealthRedirects(session.redirects, trace);
+    return new Proxy(wrappedSession, {
+        get(target, property, receiver) {
+            return property === "redirects" ? redirects : Reflect.get(target, property, receiver);
+        },
+    });
+}
+function wrapNamespace(namespace, target, trace, shouldInstrument) {
     const recorder = getTraceRecorder(trace);
     if (!recorder) {
         return target;
@@ -220,6 +483,10 @@ function wrapNamespace(namespace, target, trace) {
                 return wrapped;
             }
             const wrapped = (...args) => {
+                if (shouldInstrument && !shouldInstrument(methodName, args)) {
+                    return Reflect.apply(value, namespaceTarget, args);
+                }
+                const requestDiagnostics = snapshotRequestDiagnostics(namespace, methodName, args);
                 // Invoke first and decide by the RETURN VALUE. `runSpan` always
                 // returns a Promise, so unconditionally span-wrapping every member
                 // silently rewrote synchronous contracts: `ctx.state.namespace()`
@@ -234,18 +501,19 @@ function wrapNamespace(namespace, target, trace) {
                     result = Reflect.apply(value, namespaceTarget, args);
                 }
                 catch (error) {
+                    const sanitizedError = sanitizeRequestError(error, requestDiagnostics);
                     // A promise-returning implementation may still throw
                     // SYNCHRONOUSLY during pre-flight validation. Preserve the
                     // synchronous throw contract, but keep recording the failure
                     // span (the pre-fidelity wrapper captured these).
                     recorder
                         .runSpan(`${namespace}.${methodName}`, () => {
-                        throw error;
+                        throw sanitizedError;
                     }, {
-                        onError: (spanError) => buildSpanAttributes(namespace, methodName, args, undefined, spanError),
+                        onError: (spanError) => buildSpanAttributes(namespace, methodName, args, undefined, spanError, requestDiagnostics),
                     })
                         .catch(() => undefined);
-                    throw error;
+                    throw sanitizedError;
                 }
                 if (!isThenable(result)) {
                     // The state namespace factory returns the object whose METHODS
@@ -258,12 +526,30 @@ function wrapNamespace(namespace, target, trace) {
                         result !== null) {
                         return wrapNamespace(namespace, result, trace);
                     }
+                    if (namespace === "stealth" &&
+                        methodName === "createSession" &&
+                        typeof result === "object" &&
+                        result !== null) {
+                        return wrapStealthSession(result, trace);
+                    }
                     return result;
                 }
-                return recorder.runSpan(`${namespace}.${methodName}`, () => result, {
-                    onSuccess: (spanResult) => buildSpanAttributes(namespace, methodName, args, spanResult),
-                    onError: (error) => buildSpanAttributes(namespace, methodName, args, undefined, error),
+                const sanitizedResult = Promise.resolve(result).catch((error) => {
+                    throw sanitizeRequestError(error, requestDiagnostics);
+                });
+                const tracedResult = recorder.runSpan(`${namespace}.${methodName}`, () => sanitizedResult, {
+                    onSuccess: (spanResult) => buildSpanAttributes(namespace, methodName, args, spanResult, undefined, requestDiagnostics),
+                    onError: (error) => buildSpanAttributes(namespace, methodName, args, undefined, error, requestDiagnostics),
                 });
+                return namespace === "http" && methodName === "stream"
+                    ? tracedResult.then((spanResult) => isHttpStreamResponse(spanResult)
+                        ? instrumentHttpStreamConsumption(spanResult, recorder, args, requestDiagnostics)
+                        : spanResult)
+                    : namespace === "http" && methodName === "sse"
+                        ? tracedResult.then((spanResult) => isAsyncIterable(spanResult)
+                            ? instrumentHttpSseConsumption(spanResult, recorder, args, requestDiagnostics)
+                            : spanResult)
+                        : tracedResult;
             };
             wrappedMethods.set(property, wrapped);
             return wrapped;

package/dist/runtime/native-network.d.ts

@@ -0,0 +1,53 @@
+import { Socket } from "node:net";
+import { type TLSSocket } from "node:tls";
+import { TransportError } from "../errors.js";
+import type { NativeNetworkClient, NativeNetworkConnection, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProxyEgressInfo, ProviderProxyPolicy, ProviderProxyProvider } from "../types.js";
+export type NativeNetworkErrorCode = "native_connection_aborted" | "native_connection_closed" | "native_connection_failed" | "native_connection_idle_timeout" | "native_connection_timeout" | "native_dynamic_egress_unsupported" | "native_proxy_expired" | "native_proxy_invalid";
+export declare class NativeNetworkError extends TransportError {
+    constructor(message: string, code: NativeNetworkErrorCode);
+    get code(): NativeNetworkErrorCode;
+}
+export declare class NativeProxyExpiredError extends NativeNetworkError {
+    readonly expiresAt: string;
+    constructor(expiresAt: string);
+}
+/** Raised when an established connection exceeds its opt-in read-idle window. */
+export declare class NativeIdleTimeoutError extends NativeNetworkError {
+    constructor();
+}
+export type NativeGatewayProxy = NativeProxyEgressInfo & {
+    readonly url: string;
+};
+export type NativeGatewayProxySynthesisInput = {
+    readonly vendor: ProviderProxyProvider;
+    readonly policy: ProviderProxyPolicy;
+    readonly affinityKey?: string;
+    readonly now: number;
+};
+/** A vendor adapter in the ordered native gateway resolution chain. */
+export type NativeGatewayProxySynthesizer = (input: NativeGatewayProxySynthesisInput) => NativeGatewayProxy | undefined;
+export type NativeGatewayProxyResolutionInput = {
+    readonly policy: ProviderProxyPolicy;
+    readonly affinityKey?: string;
+    readonly now?: number;
+    readonly gatewaySynthesizers?: readonly NativeGatewayProxySynthesizer[];
+};
+export type NativeNetworkClientOptions = {
+    readonly proxyPolicy?: ProviderProxyPolicy;
+    readonly affinityKey?: string;
+    /** Stable credential/account identity; hashed before vendor synthesis. */
+    readonly credentialIdentity?: string;
+    /** Vendor adapters in priority order within each policy vendor slot. */
+    readonly gatewaySynthesizers?: readonly NativeGatewayProxySynthesizer[];
+    /** Warning-level lifecycle diagnostic sink. */
+    readonly warn?: (message: string) => void;
+    /** Delegate to the deployment's native egress authorization layer. */
+    readonly grantTcpEgress?: (input: NativeNetworkDynamicGrantOptions) => NativeNetworkEgressGrant;
+};
+/** Domain-separated, process-independent affinity derived from credential identity. */
+export declare function deriveNativeCredentialAffinityKey(credentialIdentity: string): string;
+/** Resolve the first configured native gateway without invoking an allocator API. */
+export declare function resolveNativeGatewayProxy(input: NativeGatewayProxyResolutionInput): NativeGatewayProxy | undefined;
+export declare function createNativeNetworkConnection(socket: Socket | TLSSocket, proxy: NativeGatewayProxy | undefined, options: NativeNetworkClientOptions, idleTimeoutMs?: number): NativeNetworkConnection;
+/** Create the SDK byte-stream runtime; deployment egress authorization stays delegated. */
+export declare function createNativeNetworkClient(options?: NativeNetworkClientOptions): NativeNetworkClient;